RU EN
www.
Technical audit · 31.05.2026

dataprotection.ie

Data Protection Commission of Ireland — the national GDPR regulator
IE

Ireland's GDPR regulator — the body that has issued billion-euro fines against Meta, Google, and TikTok. 79 requests, 3 domains. The Cookie Policy states: no third-party resources. The HAR records a request to code.jquery.com. One external domain against one statement — and the statement is inaccurate.

Request timeline

+134 ms · before any interaction
code.jquery.com — the jQuery UI CSS loads from the external jQuery Foundation CDN. The sole external domain in the session.
No consent banner
The site does not display a cookie banner. The Cookie Policy declares the use of only session cookies necessary for the service to function, with no analytics and no third-party resources.
Set-Cookie — zero
None of the 79 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. No session cookies are recorded in the HAR.

Declared versus actual

+ code.jquery.com — not mentioned; the Cookie Policy states there are no third-party resources — not declared

Transfer timings

+134 ms code.jquery.com

jQuery UI 1.13.2 CSS. jQuery Foundation CDN. USA.

+216 ms www.dataprotection.ie

A slider image. The site's own subdomain — not external.

Detected trackers

Indicators of GDPR non-compliance

Context

The DPC (Data Protection Commission) is Ireland’s data protection authority, the national GDPR supervisory body. It is the DPC that has issued the largest fines in GDPR history: Meta — €1.2 billion (2023), Instagram — €405 million (2022), WhatsApp — €225 million (2021). HAR: 79 requests, 3 domains — 77 to the first-party domain dataprotection.ie, 1 to the subdomain www.dataprotection.ie, and 1 to the external domain code.jquery.com.

One request against one statement

The DPC’s Cookie Policy contains a direct statement: “dataprotection.ie and its subdomains do not use any third party or persistent cookies.” The HAR records a request to code.jquery.com at +134 ms — jQuery UI 1.13.2 CSS, loaded from the jQuery Foundation CDN (USA). This is an external domain, not one belonging to the DPC. Every visitor to the site transmits their IP address to jQuery Foundation’s servers, whereas the policy states that this does not occur.

The scale matters here: this is the sole external domain, a single request, one CSS file. Not a tracker, not analytics, not an advertising network. jQuery UI could be hosted locally — a standard practice for organizations with privacy requirements. The non-compliance lies not in the nature of the resource but in the gap between the documented statement and the technical fact.

What has been done correctly

The site’s architecture is, on the whole, minimalist: 77 of 79 requests go to the first-party domain. There is no Google Analytics, no GTM, no advertising networks, no Google Fonts, and no cookie banner (because there is nothing requiring consent). Set-Cookie is zero across the entire session. This is substantially better than most sites in the Irish series, including the CSO.

Documentation accuracy

A regulator that fines companies for discrepancies between their declared and actual data-processing practices allows precisely such a discrepancy on its own site. The Cookie Policy was last updated in August 2023 — after that date, the connection to an external jQuery CDN either went unnoticed or was not considered significant. Under the standard set by Art. 13(1)(e) and the ePrivacy Regulations, documentation should reflect the actual set of external connections. The fix is technically trivial: host jquery-ui.css locally and update the policy.

Conclusion

dataprotection.ie demonstrates one of the cleanest architectures in the Irish series: one external domain, zero cookies, zero analytics. The sole finding is a formal one: the Cookie Policy declares the absence of third-party resources, whereas one such resource is present. For a regulator whose job is to ensure the accuracy of data documentation, this is precisely the kind of discrepancy that should not appear on its own site.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/dataprotection-ie-2026-05-31.har
SHA-256: 5c090a7d974e84616c37cf736da03df306d721dbaa1e74de900e267d76dba59f
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — dataprotection.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website dataprotection.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The Cookie Policy states: 'dataprotection.ie and its subdomains do not use any third party or persistent cookies.' The HAR records a request to code.jquery.com (+134 ms) — an external domain belonging to the jQuery Foundation (USA), loading before any user interaction. The policy's statement does not match the technical fact.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-dataprotection-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — dataprotection.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website dataprotection.ie.

2. Circumstances
I visited the website dataprotection.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Cookie Policy states: 'dataprotection.ie and its subdomains do not use any third party or persistent cookies.' The HAR records a request to code.jquery.com (+134 ms) — an external domain belonging to the jQuery Foundation (USA), loading before any user interaction. The policy's statement does not match the technical fact.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-dataprotection-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e); ePrivacy Regulations (SI 336/2011)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]